PT-2026-50130

Name of the Vulnerable Software and Affected Versions Remark42 versions 1.6.0 through 1.15.0 Description Remark42 contains a Cross-Site Scripting XSS issue exploitable through content-type spoofing via the image proxy. The proxy fetches a remote URL and re-serves the response from its own origin....

EUVD-2026-36916

Editor Privilege Escalation in AI Engine = 3.4.9 versions...

CVE-2026-49770

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-49078

Unauthenticated Other Vulnerability Type in WP Travel Engine = 6.7.10 versions...

CVE-2026-27407

Editor Privilege Escalation in AI Engine = 3.4.9 versions...

irrd (>=4.4.0, <=4.4.3), ofjustpy (1.1.2) +3 more potentially affected by CVE-2026-54282 via starlette (0.31.0)

starlette PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - irrd =4.4.0, =4.4.3 - ofjustpy 1.1.2 - ofjustpy-engine 1.1.3 - ofjustpy-plugins 0.0.1 - oj-signing-middleware 0.2.1 Source cves: CVE-2026-542...

CVE-2026-49770

CVE-2026-49770 affects the WordPress WP Travel Engine plugin (

CVE-2026-49770 WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-49770 WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

EUVD-2026-36893

Unauthenticated PHP Object Injection in WP Travel Engine = 6.7.12 versions...

CVE-2026-49078 WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in WP Travel Engine = 6.7.10 versions...

CVE-2026-49078 WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in WP Travel Engine = 6.7.10 versions...

CVE-2026-49078

Technical details for CVE-2026-49078 are not publicly available in the provided documents. Monitor updates from Patchstack/CVE entries for affected version 6.7.10 and potential fixes.

EUVD-2026-36877

Unauthenticated Other Vulnerability Type in WP Travel Engine = 6.7.10 versions...

CVE-2026-27407 WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability

Editor Privilege Escalation in AI Engine = 3.4.9 versions...

CVE-2026-27407

CVE-2026-27407 concerns the WordPress AI Engine plugin, affected versions

CVE-2025-68840

CVE-2025-68840 is a reflected XSS vulnerability in the WordPress plugin iRobots.txt SEO, affected versions:

irrd (>=4.4.0, <=4.4.3), ofjustpy (1.1.2) +3 more potentially affected by CVE-2026-48818 via starlette (0.31.0)

starlette PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - irrd =4.4.0, =4.4.3 - ofjustpy 1.1.2 - ofjustpy-engine 1.1.3 - ofjustpy-plugins 0.0.1 - oj-signing-middleware 0.2.1 Source cves: CVE-2026-488...

irrd (>=4.4.0, <=4.4.3), ofjustpy (1.1.2) +3 more potentially affected by CVE-2026-48817 via starlette (0.31.0)

starlette PYPI version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - irrd =4.4.0, =4.4.3 - ofjustpy 1.1.2 - ofjustpy-engine 1.1.3 - ofjustpy-plugins 0.0.1 - oj-signing-middleware 0.2.1 Source cves: CVE-2026-488...

CVE-2026-48708

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance tpl package-level variable in service/internal/tpl/templates.go across all goroutines. Every action execution calls...